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METHOD AND SYSTEM FOR OVER-THE-AIR (OTA) SERVICE 

PROGRAMMING 

BACKGROUND OF THE INVENTION 

I. Cross References to Related Applications 

This appUcation claims the benefit of US. Provisional application 
Serial Number 60/005,011, filed on October 10, 1995. 

10 

IL Fidd of the invention 

This invention relates to commu^.i^; systems, more particularly 
the present invention relates to an approach supporting over-the-air 
IS COT A") service programming of a mobile station. 

HL Description of the Related Art 

Conventionally, an activation process for a newly purchased mobile 
20 station is a manually intensive and time consuming process. One of the 
limitation with this amventional activation process is that the user must 
bring the mobile station to a service center in order to activate the mobile 
station. 

A Mobile Station is a subscriber station in the category of Domestic 
25 Public Cellular Radio Telecommunications Service, normally intended to be 
used while in motion or during halts at unspecified points. The category 
includes true mobile stations, handheld portable stations, fixed stations, and 
other devices. 

At the service center a technician programs (stores) into the mobile 
30 station various parameters which indude information that allows the unit 
to communicate on the network and which define the mobile station's 
network identity. Optionally, manufacturer specific information may also 
be programmed into the mobile station. Multiple parameter sets axe 
sometimes provided in a mobile station so that, for example, the mobile 
35 station can have local identities ta\ different service areas. 

If information stored in a previously activated mobile station needs to 
be changed, conventionally the process is also manually intensive and time 
consuming. One of die limitations with this conventional process is that 
the user must bring the mobile station to a service center in order to have a 
40 technician change the information in the mobile station. 
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SUMMARY OF THE INVENTION 

Accordingly, one object of this invention is to provide a novel 
method to activate a mobile station for use within a communications 
5 network without the user having to bring the mobile station to a service 
center or third party. 

Another object of mis invention is to provide a novel method to 
change information in a mobile station for use within a communications 
network without the user having to bring the mobile station to a service 
10 center or third parry. 

Hereafter, these two objects of this invention, namely to activate a 
mobile station and to change information within a mobile station without 
the user having to bring the mobile station tc a service center or third parry 
will be referred to as over-the-air servic r .^«mming (OTASP). 
15 Another object of the present invention is to provide a signaling 

infrastructure to accomplish the over-the-air service programming of a 
mobile station for use within a communications network with minimal 
mobile switching center (MSQ and visitor location register (VLR) 
involvement. 

20 The above and other objects are achieved according to the present 

invention by providing a new and unproved signaling infrastructure and 
method for over-the-air service programming a mobile station for use in a 
communications network. 

According to the invention, the mobile station transmits a message 
25 including an over-the-air service programming request, the mobile station 
identification presently stored in the mobile station and the mobile station's 
electronic serial number, to a mobile switching center coupled to the 
communications network. If the mobile station can have multiple 
identities, as discussed above, the user selects the mobile station identity to 
be in effect during the over-the-air service progr am ming procedure. 

An Electronic Serial Number is a 32-bit number assigned by the 
mobile station manufacturer, uniquely identifying the mobile station 
equipment. 

The mobile station identification (MSID) can be either the mobile 
Identification number (MLM) or the international mobile station identity 
(IMS). Mobile Identification Number (MIN) is a 34 bit number mat is a 
digital representation of the 10 digit number assigned to a mobile station. 
International Mobile Station Identity (IMS!) is a number up to 15 digits in 
length which uniquely identifies a mobile station internationally. m what 



30 



16/06/00 12:25 PATENT EXPRESS ■> 2123 0 3 2 656 ND.B66 P007 




WO 9111425$ 

3 

follows, whenever we refer to a mobile identification number, it is implicit 
that an IMSI could very well be used in the place of KON. 

This results in the mobile station getting connected to an initial 
service unit via a voice connection. A Temporary Reference Number (TKN) 
5 identifying the mobile switching center and die mobile station is allocated 
for the mobile station at the mobile switching center. The TRN can be a 
mobile station identification (MSID), a telephone directory number or any 
other number. 

In what follows, whenever we refer to a mobile identification 
10 number, it is implicit that an IMSI could very well be used in the place of 
MIN. 

If the TRN is not an MSID, a unique and temporary mobile 
identification (MSID) must also be allocated for use during the service 
programming procedure. 

15 The TRN and, if possible, the temporary mobile station identification 

(MSID) if one is allocated, the MSID presently in the mobile station, and the 
electronic serial number are sent to the service unit during voice connection 
set up. It may not be possible to send MSIDs and the electronic serial number 
to the service unit since some systems on die voice connection set up path 

20 may allow only valid directory numbw- -J _21~*/ only directory numbers 
assigned to the MSG to be passed. 

If it is determined that the initial service unit is not the desired 
service unit, the voice call gets forwarded to one service unit after another 
until a desired service unit is readied. The TRN, and possibly the MSID and 

25 the electronic serial number, also get sent to the final service unit 

The final service unit selects a home location register within the 
communications network with which the mobile station is to be associated. 

The home location register then gets associated with the mobile 
switching center by the home location register sending a message containing 

30 the TRN to the mobile switching center. The home location register is able 
to send a message to the mobile switching center because the TRN identifies 
the mobile switching center* The mobile switching center uses the TRN to 
identify die mobile station whose oveMhe-air service programming is being 
carried on* The mobile switching center sends a message back to the home 

35 location register containing the temporary MSID, if one was allocated at the 
mobile switching center, the MSID presently contained in the mobile 
station, and the mobile station's electronic serial number, if these were not 
received at the final service unit during voice call set-up. If the TRN is 
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distinct from die temporary mobile identification number, it is released at 
the mobile switching center. 

Hereafter, information regarding the mobile station contained at any 
network element is referenced using the temporary MSID, which could be 

5 the l^N itself, and the mobile station's electronic serial number. 

The service unit or the home location register may query, via the 
communication network, die mobile station for some information 
contained in the mobile station. The service unit or the home location 
register may allocate a new permanent MSID for the mobile station and 

10 transfer service programming information, possibly including the newly 
allocated permanent MSID, into die mobile station via the mobile switching 
center using the communications network. The service unit also transfers 
service programming information associated with die mobile station into 
the home location register. 

15 After die service programming information is successfully transferred 

to the mobile station, the service unit or the home location register sends a 
message to die mobile station via die communications network instructing 
it to transfer the service programming information to its non-volatile 
memory. The information sent to the mobile station is also stored in non- 
20 volatile memory in die KLR and/or authentication center (AC). 

The mobile switching center is used merely as a conduit for 
messaging performed between the home location register and the mobile 
station and between die service unit and the mobile station. 

The home location register inchy*es a database that contains 

25 registration and user profile information for the system subscribers. Hie 
mobile switching center provides interconnection services among wireless 
subscriber stations, and between wireless subscriber stations and die public 
switched telephone network (PSTN) via one or more base stations (BS) 
under its control. The PSTN is a telecommunications network commonly 

30 accessed by ordinary telephones, private branch exchange trunks and data 
transmission equipment that provides service to the general public. The 
base station is a fixed station used for communicating with mobile stations. 
Depending on die context, the term base station may refer to a cell, a sector 
within a cell, an MSC, or other part of die cellular system 

35 The method of OTA service programming according to the present 

invention minimizes the involvement of the MSC and Visitor Location 
Register (VLR) with OTA processing. The VLR links to one or more MSCs, 
and includes a database for temporarily storing part of subscription data and. 
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in certain cases, security related data for a mobile station currently served by 
its corresponding MSC 

The over-the-air service programming process also needs the 
involvement of the authentication center for the purpose of storing the 
5 mobile station's security related data and for performing security related 
procedures needed for downloading the Authentication-Key (A-Key) to the 
mobile station and for invoking voice privacy and/or signaling message 
encryption for security purposes on the air-link between the mobile station 
and the base station. 

10 The Authentication Center (AC) is an entity that manages the security 

aspects related to the mobile station. The Authentication-Key is a concealed 
bit pattern stored in the mobile station and the AC It is used to generate and 
update the mobile station s SSD, which is used for authentication, voice 
' privacy and signaling message encryption. Shared Secret Data (SSD) is a bit 
15 pattern stored in the mobile station and known by the AC, and possibly by 
the VLR. Shared Secret Data is maintained during power off. 

The service unit interfaces normally with the HLR. Hence 
communication between the service unit and the AC is generally via the 
HLR. To accomplish communication between the HLR and die AC, the 
20 present invention proposes new messages between the home location 
register and the authentication center. 

Advantageous aspects of OTA service programming according to the 
present invention include 

1) OTA service programming according to the present invention 
25 need not involve the MSC/VLR with the details of service programming as 

the process is primarily one of initializing the mobile station's and 
HLRV Authentication Center's (ACs) databases. 

2) By minimizing the MSC/VLR ir-v?rementr enhancements to the 
OTA service programming process can be made without changing MSC and 

30 VLR software. 

3) The HLR/ AC controls the service programming process acting as a 
Service Control Point (SCP) to control overthe-air service programming. 

4) For control, the CSC only need* to interface to the HLR- The voice 
connection to die CSC may be through the network or direct from the MSC 

35 The method of OTA service programming according to the present 
invention supports either method- 

5) The HLR can be chosen after the activation process begins. This 
allows the mobile station to activate anywhere within the operator's service 
area. Given the appropriate agreements and network support, there is 
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nothing to prevent a mobile station from being activated in any HLR having 
connectivity with the MSC 

6) The MSC is used merely as a conduit for messaging performed 
between the HLR and the mobile station. 

5 

BRIEF DESCRIPTION OF THE DRAWINGS 

The features, objects, and advantages of the present invention will 
become more apparent from the detailed description set forth below when 
10 taken in conjunction with the drawings in which like reference characters 
identify correspondingly throughout and wherein: 

FIG, 1 is block diagram of a network reference model with one HLR 
and one CSC; 

FIG. 2 is block diagram of a network reference model with multiple 
15 HLRs and one CSQ 

FIG. 3 is block diagram of a network reference model with multiple 
HLRs and separate CSCs; 

PIG- 4A is a flowchart illustrating a process for programming a mobile 
using OTA service programming; 
20 PIG- 4B is a continuation of the flowchart in Figure 4A; 

FIG. 4C is a call flow diagram showing signaling in an exemplary 
communications network in which an original voice connection is call 
forwarded from a first CSC to a second CSC; 

FIG. 4D is a continuation of the flowchart in Hgure 4B; 
25 FIG. 5 is a call flow diagram showing signaling for deregistering an old 

MSXD associated with a mobile unit according to the present invention; 

FIG 6 Is a call flow diagram showing an A-Key transfer procedure 
according to the present invention; 

FIG. 7 is a call flow diagram showing an SSD update procedure 
30 according to the present invention; and 

FIG. 8 is a call flow diagram showing a ^authentication procedure 
according to the present invention. 

DETAILED DESCRIPTION ~ r **E PREFERRED 
35 EMBODIMENTS 

Referring now to the drawings, wherein like reference numerals 
designate identical or corresponding parts throughout the several views, 
and more particularly to FIG. 1 thereof, there is illustrated a block diagram of 
40 a network reference model 100 according to the present invention. In the 



16/06/00 12:26 PATENT EXPRESS * 2123032656 



NO. 866 P011 



CA 02234559 1991-94-99 
WO 97/14251 rCT/C$S*/l**4 

7 I 
description that follows, the network reference model is first explained and | 
is followed by related network models illustrated in FIGS. 2 and 3. j 
Subsequently, FIGS. 4A, 4B and 4D illustrate process steps employed by the '! 
network and FIGS. 4.C, 5, 6, 7 and 8 illustrate signaling employed in the 
S network. 

The network reference model 100 of FIG. 1 includes a mobile station ! 
(MS) 2 coupled to a base station (BS) 6 via an interface, U m , 4; the BS 6 is 
coupled to a mobile switching center (MSC) 10 via an interface. A, 8; the 
MSC 10 is coupled to a visitor location register (VLR) 14, and a home I 

10 location register (HLR) 18 via interfaces, B, 12, and C, 28, respectively; the 

VLR 14 is coupled to the HLR 18 via an interface, D, 16; and the HLR 18 is 1 
coupled to an authentication center (AC) 22 and a customer service center (■ 
(CSC) 26 via interfaces, H, 20 and P (proprietary) 24, respectively. A voice 
connection is established between the MSC 10 and the CSC 26, as indicated by ' 

15 the dotted line 46. Interfaces A, B, C, D, H and Um are industry standard 
interfaces, and are used, for example in the Telecommunication Industry 
association (T1A) IS41-C standard on Cellular Radiotelecommunications 
Intersystem Operations, Note mat in FIG. 1, there is only one HLR associated j 
with the CSC [ 

20 FIG. 2 is a block diagram of a network reference model 200 including 

multiple HLRs. In addition to the elements of the network reference model 
100, the network reference model 200 includes an HLR 38 cxwpled to the CSC 
26, the MSC 10, the VLR 14 and an AC 42 via interfaces P (proprietary) 36, C 
34, D 48 and H 40, respectively. FIG 2 shows a case when there is a choice of 

25 HLRs on which the mobile station's data can be stored. In this case, a single 
CSC is affiliated with the HLRs. 

FIG. 3 illustrates a block diagram of a network reference model 300 
including multiple HLRs and CSC*. The network reference model 300 
includes the elements of the network reference model 200 with an 

30 additional CSC 44 and die voice connection 54. In this figure, HLR 38 is 
coupled to CSC 44 via interface P 36 and CSC 26 forwards the voice 
connection 46 to CSC 44 using voice connection 54 in a voice call-forward I 
operation. In FIG 3, each HLR 18, 38 corresponds to a different CSC 26, 44, 
respectively. 

35 Invocation of over the air (OTA) service programming according to j 

tiie present invention will first be described with respect to the network 
a r c hit ect ur e s shown in FIGS. 1-3. Subsequently, the function and processes 
performed in accomplishing OTA service programming will be described { 
with respect to FIGS. 4-8. 
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With reference to FIG. 1, OTA service programming begins with the U 
mobile station (MS) 2 initiating an over-the-air service programming call. 
The user will initiate this call because, for example, the user has just i 
purchased a mobile telephone from a retail vendor and the user wants to j 
5 operate the telephone for normal use without having to travel to a service 

center to activate the phone, or because! the user wants to change j 
information in the mobile station, or because, the service provider instructs j 
the user to place an over-the-air service programming call in order for the 
service provider to change certain information in the mobile station. To 
10 accomplish this, the user inputs an over-die-air service programming code 
message at the mobile station 2 having a specific preamble, eg., "*22", which 
indicates the user wishes to request over-the-air service programming. 
After the preamble, the user inputs data indicating the system desired. For . 
example, the user enters "XXX* indicating a specific system over which the [ 
15 user wishes to subscribe, such as system A or system B (•22800 or •22801), 
"YYYYV where YYYY is a System Identification number ("SID") of a 
preferred service provider, or "77777" indicative of a Time Division 
Multiple Access (TDMA) System Operator Code (SOC). Instead of the user 
manually entering the over-the-air service programming code message on j 
20 the mobile station, a user may press a button on die mobile station resulting | m 

in a similar effect as die one when the user manually enters the over-die-air ! 
service programming code message on die mobile station. If the mobile j 
station can have multiple identities as discussed above, the user selects the j 
mobile station identity to be in effect during the OTASP procedure, ! 
25 Through the air interface 4, die mobile station 2's call is passed to the 
serving MSC 10 via die base station 6 and interface 8. At the same time an 
electronic serial number (ESN) of the user's mobile station and die MSID p 
presently in the MS get passed to die MSC 10, which the MSC 10 saves. j 
In response to die mobile station 2's call, die MSC 10 supplies a 
30 temporary reference number (TUN), associated with the mobile station 2 I 
and which identifies the MSC and routes die call to die CSC 26 via voice ? 
connection 46* The TRN can be a mobile station identification (MSID), a 
directory number or any other number. Alternatively, traceable TRNs are ^ 
used where the CSC can screen the incoming TRN to determine if die TRN 
35 is from a valid directory of numbers assigned to the MSC 10. If the TRN is j 
not an MSID, a unique and temporary MSID must also be allocated for use j 
during die service programming procedure. j 
In the network shown in FIGS- 1 and 2, the call is routed directly to j 
the CSC 26 via voice connection 46, although as shown in FIG. 3, die call ! 



16/36/00 12:27 PATENT EXPRESS -> 2123032656 



N0.B66 P013 



CA #2234559 l998-t4-*9 

WO 97/14258 KTAJSW16364 

9 

may be forwarded, through call-forwarding, via a second voice connection 
54 to a second CSC 44. In either case, the TRN serves as the initial reference 
for the over-the-air service programming attempt and is supplied to the CSC 
26 (or 44) as part of call setup. 
5 The TRN could be hosted in an Integrated Service Digital Network 

(ISDN) User-to-User element or part or the Calling Party number field, or 
other suitable means for conveying the number. 

Once the call from Ave MSC 10 arrives at the CSC 26 the CSC responds 
in the following way. A voice operator (or a voice response unit, etc.) at the 
10 CSC 26 will begin a dialog with die user of 7>oWle station 2 / during which 
the CSC 26 will identify (select) which HLR 18 or 38 (in FIGS. 2 and 3) will be 
used to communicate with the MSC 10 on a data connection to be 
established between the HLR 18 and MSC 10. For example, a service 
provider may service both New York and Los Angeles with corresponding 
15 HLRs. A user from Los Angeles may wish to program the user's mobile 
station while visiting New York. In this case, the New York CSC operator 
may forward the ustr's call to a Los Angeles CSC operator. If Ate HLR 
selected for programming is directly co n nected to the CSC 26 (FIGS. 1 and 2), 
the CSC 26 begins the over-the-air service programming by contacting the 
20 designated HLR (HLR 18 via proprietary interface 24 or HLR 38 via 
proprietary interface 36 in FIGS. 1 and 2). The TRN that was supplied by the 
MSC 10 is provided to die designated HLR via CSC 26, where the CSC 26 
triggers the designated HLR to establish a data connection (through VLR 14 
and interfaces 16 and 12) to MSC 10. In FIG. 1, the data connection includes 
25 the HLR 18, interface 16, VLR 14 interface 12 and MSC 10. In FIG. % if HLR 
18 is the desired HLR, the data connection is the same as FIG. 1. In FIG. 2, if 
HLR 38 is the desired HLR, the data connection includes HLR 38, interface 
48, VLR 14, interface 12 and the MSC 10. In FIG. 3, if the HLR 38 selected for 
over-the-air service programming is not dr : ?2y connected to the CSC 26, 
30 then the CSC 26 forwards the call to CSC 44 which is connected to HLR 38 
and selected for o v er- th e * ir service pr ogra mmin g via a voice connection 34. 
The TRN that was assigned by the MSC 10 must be forwarded to CSC 44. By 
call forwarding, die mobile station 2 ran be serviced on any HLR which 
supports the OTASP procedures. In FIG. 3, the data connection includes the 
35 HLR 38, interface 48, VLR 14, interface 12 and MSC 10. 

Once the designated HLR (18 or 38) has been triggered by the CSC 26 
(In FIGS. 1 and 2), or HLR 38 by CSC 44 (in FIG. 3), the HLR establishes a data 
connection to the MSC 10 baaed on the TRN provided to the HLR from the 
CSC The HLR 18 is configured to identify the MSCs address from the TRN, 
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and because the HLR 18 usually stores records based on a mobUe station's 
ESN and MSID, the HLR requires the mobile station s ESN and the 
temporary MSID from the MSG in order to store a record for the mobile 
station 2. Ihe HLR also requires the MSID that is presently in the MS for 
5 use in SSD update procedures as will be explained later. Accordingly, the 
designated HLR contacts the MSC 10 via the data connection, in order to 
retrieve die mobile station 2's ESN, the MSID that is presently in the mobile 
station and the temporary MSID, if distinct from the TRK. We are 
assuming that the temporary MSID, the MSID presently stored in the MS 
10 and the ESN were not communicated to die CSC during the voice call set up 
and hence need to be retrieved from the ^!SC. As will be described in 
reference to the following flow charts and call diagrams, the data connection 
is then associated with the mobile station 7 once associated, the CSC 26 
(or 49) may pass data to the mobile station 2 and program the mobile station. 
15 FIG, 4A is a flowchart of the steps performed to functionally 

accomplish the inventive OTA service programming process. The process 
beings at step Si where in order to place the over-the-air service 
provisioning call the user, following an instruction manual provided with 
the telephone, dials the activation code preamble C*22") followed by the 
20 appropriate three to five digit extension, discussed earlier, corresponding 
with a specific system, SID, or TDMA SOC During this step, the mobile 
station 2 transmits die over-the-air service programming request, the MSID 
that is presently in the mobile station and its unique ESN to the MSC, where 
the MSC stores the mobile station 2 s ZS.J and die MSID that is presently in 
25 die mobile station. The MSC allocates » Temporary Reference Number 
(TRN) identifying the mobile switching center and the mobile station. If the 
TON is not an MSID, a unique and temporary MSID is also allocated for use 
during the service programming procedure. ■ 

The process then proceeds to step S3 where .the MSC servicing the 
30 mobile station 2 establishes a voice connection 46 between the mobile 
station 2 and the appropriate CSC (e.g., CSC 26 in FIG 1). 

After the voice connection is mad- *\ - process proceeds to step S5 
where the user provides user-specific information (such as residence 
address, credit card number, etc) to a CSC operator at the CSC 26. In light of 
35 die user-specific information, die process flows to step S7 where the CSC 26 
determines whether it is the correct CSC to service the user (e-g., CSC 44 of 
FIG. 3 may be the correct CSQ- If not the process proceeds to step S9 where 
the mobile station 2's call is forwarded to a correct CSC (eg., CSC 44 m PIG. 3) 
and the process then flows to step S5. However, if in step S7 it is determined 
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that the user is connected with the correct CSC (e.g., CSC 26 in FIC. i). the 
process flows directly to step Sll. 

In steps S3 and S«, the TRN is provided from the MSC 10 to the CSC f 
26, in Ac form of data, through the voice call set up procedure for the vo 4 ce 
5 connection 46. The TRN is unique to the call being made and is used by the 

CSC 26 and MSC 10 as a transient (temporary) identifier of the mobile station j 
2's request for over-the~air service programming. Attributes of the TRN 
include (1) mobile station identifiabiiity which permits the CSC to identify j 
the mobile station in question, and (2) MSC addressability which permits L 
10 other network resources, such as the HLR, to uniquely identify the MSC 

servicing the mobile station 2 by the TRN. j 
Up to this point in the % process, a voice call and a TRN have been | 
established, but a data connection which will enable OTA programming data f 
to oe downloaded to die mobile station 2 has not been established. 
15 Accordingly, after step S7, the process proceeds to Step Sll where the CSC {26 
or 44) triggers HLR (18 or 38) over a proprietary link (P) with a message 
including the TRN. Based on the MSC addressability attribute of the TRN, 
the HLR (18 or 38) is able to ascertain the address of the MSC 10 servicing the j 
mobile station Z 1 * I 

20 The process then proceeds to step $13 where die HLR 18 dispatches a 

new over the air service programming INVOKE message, 
OTAServiceProgranuning INVOKE (OTASERFROG) to die MSC 10 via VLR u 
14 (see FIGS. 1, 2 and 3)* The OTASERFROG message is communicated 
through the VLR 14 because, by industry convention, communications from 
25 HLRs are typically routed through VLRs. Alternatively, however, the HLR j 
(18 or 38) could dispatch the OTASERPROG message directly to the MSC 10. 
The combination of the HLR (18 or 38), VLR 14 and MSC 10 (along with the 
corresponding interconnecting interfaces) form a data connection between 
the CSC (26 or 44) and the MSC 10 that parallels die on-going voice 
30 connection 46 (Or 46 and 54) between the mobile station 2 and the CSC (26 or 

44). This data link will later be used to communicate service programming j 
data between the mobile station 2 and the HLR 18 (or 38). After the step S15, j 
die process proceeds to step S17 which is shown in FIG. 4B. j 
FIG. 4B is a flowchart that shows additional steps to the process started j 
35 in the flowchart of FIG* 4A. After step $15 (FIG. 4A), die process flows to step [ 
S15 where the MSC 10 receives the OTASERPROG message. In step SI 7, the 
MSC 10 associates the voice connection (call) with die data connection (eg., 
as shown in PIG* 1, die data connection being between HLR 18, interface 16, 



16/06/00 12:27 



PATENT EXPRESS * 2123032656 



NO. 866 P016 



CA 0 2 23455* 1 0*1 -$4 

WO 97/14258 PCT/US96U6364 

12 

VLR 14, interface 12, and MSC 10) using the TRN supplied to it in the 
OTASERPROG message. 

Up to this point in the process, a data connection has been established 
between the mobile station 2 and the HLR 18 (or 38), but the HLR 18 (or 38) 
5 does not yet have the specific informa*-- i* * the mobile station 2 in 
order to properly activate the mobile station 2. If the HLR 18 (or 38) 
(cooperating with the authorization center AC 22 (or 42) were to program 
the mobile station 2 without more information, the following two problems 
would arise. First, '"pirated'" mobiles could obtain access to the 
10 communications system, because there has not yet been any accountability 
made of the mobile station's ESN. Second, the HLR 18 (or 38) requires a 
mobile's MSID and ESN in order to uniquely create and retrieve HLR 18 (or 
38) records corresponding to the mobile station 2. Also, the AC needs the 
MSID presently stored in the mobile station for use in SSD update procedure 
15 as will be explained later. 

Accordingly, after step S17, the process proceeds to step S19 where the 
MSC 10 sends an OTASerrfceProgramming RETURN RESULT (otaserprog) 
message to the HLR 18 (or 38) through the data connection/ where the 
otaserprog message includes the mobile station 2's ESN, the MSID presently 
20 stored in the mobile station, and the temporary MSID if allocated at the MSC 
10. If the temporary MSID was allocated at the MSC, the TRN is no longer 
needed and is released. Hereafter, all data communications relating to the 
mobile station 2 is ref e ren c ed by the temporary MSID (which could be the 
same as Ae TRN) and the ESN- Note * 1 —mention used herein for 
25 identifying originating (INVOKE) messages uses UPPER CASE letters, and 
response (RETURN RESULT) messages use lower case letters (compare 
OTASERPROG, and otaserprog). 

The process then proceeds to step S21 where the HLR 18 (or 38) 
receives the otaserprog message containing the mobile station 2's ESN, the 
30 MSID presently stored in the mobile station, and the temporary MSID. The 
combination of the ESN and the temporary MSID provide all the 
information required for the HLR 18 to keep a ream! for the mobile station 
2, and to communicate with the mobile station 2, via the data connection. 
The MSID presently stored in the mobile station is saved at die HLR for later 
35 use if SSD update procedures are performed. We are assuming that the 
temporary MSID, the MSID presently stored in die mobile station and the 
ESN were not communicated to the CSC during voice call set up and hence 
need to be retrieved from the MSC 
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After step 521, the process flows to step S23 where the HLR 18 ( ur 38) 
determines whether other OTA services are to be performed for the mobile 
station 2. If so, the process flows to the process shown in the flowchart of 
FIG. 4D, and later returns to step S25. If no other functions are to be 
5 performed, as determined in step S23, the process flows to step S27. In step 
S25, the HLR dispatches an OTA Data message, in OTASERPROG message, 
In which data required for service programming the user's mobile station 2 
telephone (e.g., permanent MSID) is passed through the data connection and 
received by the mobile station 2. The OTA Data message is the message that 

10 gets communicated between the MS 2 ana the MSC 10. Subsequently, a 
second OTA message (in step S27) is sent to the mobUe station 2. in 
OTASERPROG message, directing the mobile station 2 to transfer service 
programming data has been sent to the mobile station 2 to its non-volatile 
memory. In step S29, where the MSC 10 determines whether the mobile 

15 station 2 is to be deregistered (Le., have the MSC/VLR, 10/14, serving system 
remove the mobile station 2's MSID. from the serving system's registers). If 
the mobile station 2 is not to be deregistered, die process proceeds back to 
step S33 of FIG 4B. However, if the mobile station 2 is to be deregistered, the 
process proceeds to step S31 where a dexegistration process is performed 

20 (which will oe explained with reference to FIG- 3). Once the deregistration 
process is performed, the process proceeds to step S33. 

Then, in step S33 the mobile station 2 terminates the voice 
connection with the CSC and the process ends. 

FIG. 4C is a call flow diagram using the OTASERPROG and otaserprog 

25 messages and which corresponds to the process described in the flowcharts 
of FIGS. 4A and 4B. As discussed above, the present invention contemplates 
that the VLR 14 and MSC 10 are used primarily as conduits for message 
transfer between the mobile station 2 and the HLR/ AC 18/22 (or 38/42), and 
need not play an active role in the mooue station 2 service programming 

30 process. This is achieved through definition of a nova 1 (OTASERPROG) 
INVOKE and RETURN RESULT message, within which the OTA Data 
message, which is die message communicated between the MSC and the MS 
containing OTA Service Programming related information, can be 
encapsulated. The OTASERPROG message is sent from HLR 18 (or 88) or 

35 the AC 22 (or 42) to MSC 10- If an encapsulated OTA Data message is present, 
it will generally be extracted by the MSC 10 from the OTASERPROG 
INVOKE message sent from the HLR 18 (or 38) or the AC 22 (or 42) to the 
MSC 10. 
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The otaserprog message is sent from the MSC 10 to the HLR 18 (or 38) 
or the AC 22 (or 42). If an OTA Data message is to be sent to the HLR or the 
AC, it is encapsulated by die MSC 10 in the OTASERPROG RETURN 
RESULT message sent from the MSC 10 to the HLR 18 (or 38) or the AC 22 
5 (or42). 

That is, the over-the-air service programming process may 
advantageously be performed without substantive involvement of any 
processing resources of the VLR/MSC (14/10) 

Apart from communicating OTA Data messages between the MS and 
10 the HLR or the MS and die AC, the OTASERPROG INVOKE and RETURN 
RESULT messages being also used for other purposes such as "Attaching the 
MSC with the HLR via a Data Connection" and Sending Encryption 
Parameters to the MSC 

Although for completeness, the ~w L**w diagrams of FIG. 4C (as well 
15 as the other flow diagrams) depict message transfer to and from the 
VLR/MSC, it is to be understood that the system according to the present 
invention does not contemplate that processing or control functions are 
performed within the VLR/MSC during the OTASP process. 

In FIG. 4C (as well as the other call flow diagrams) general descriptive 
20 legends are provided with respect to the specific calls. In these figures, the 
dashed arrows r e pr esent a voice or traffic channaL 

The structure of the call flow diagrams is described with reference to 
FIG. 4C The top portion of FIG. 4C corresponds to the MS 2, MSC 10, VLR 
14, HER 18, CSC 26, HLR 38 and CSC 44 which are also shown in FIG. 3. The 
25 MSC 10 and VLR 14 jointly form a serving system which serve the MS 2 in 
the MS's present geographic location, the HLR 18 and the CSC 26 jointly 
form an initial home service ("initial"), but are replaced by redirected home 
service ("redirected") by forwarding the mobile station 2's voice call, as will 
be described, to the redirected home service. Along the right hand portion 
30 of FIG. 4C labels (steps) indicative of steps in the signaling procedure. 

Referring to step 100 in FIG. 4C a call is delivered from the mobile 
station 2 CMS 2") to the CSC 24 at step 100, which corresponds with steps S 1 
and S3 of FIG. 4A. In step 200, (step S- ~J.«C 4A), ah operator at the initial 
CSC 26 receives the call and begins a dialog with the user of the mobile 
35 phone. During the CSC operator's conversation with the user, the operator 
determines that the user should be assigned to the redirected HLR 38 and 
redirected CSC 44, S5 and S7 of FIG. 4A. Accordingly, in step 300 the CSC 
operator initiates a call-forwarding operation (step S9 in FIG. 4A) where the 
mobile station 2's call is forwarded to the redirected HLR 38 and the 
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redirected CSC 44. During this call forward operation, the TRN received at 
the first CSC 26 from the MSC 10 is sent to the redirected CSC 44. Then, at 
step 400, the mobile station 2's user speaks with the CSC operator at the 
redirected CSC 44 and provides the redirected CSC operator with requisite 

5 information for establishing a service for the user's mobile station. 

At step 500, the CSC 44 contacts (triggers, step SIX in FIG. 4A) the HLR 
38 over the proprietary interface 36 (FIG. 3) and transfers the TRN to the 
HLR 38. With the TRN, the HLR derives the address of die MSC 10 based on 
the identifiability attribute associated with the TRN. 

10 At step 600, the HLR 38 transfers the TRN and an Action Code in an 

OTAServiceProgramming INVOKE message, OTASERPROG(TRN, 
ActionCode), to the VLR 14, which simply forwards the same message in 
step 700 to the destination MSC 10. (Steps 600 and 700 correspond with step 
S13 of FIG. 4A). The OTASERFROG message contains at least two fields 

15 including an action code field (ActionCode) and a TRN field. Data in the 
action code field is interpreted by the MSC 10 as "Attach the MSC with the 
HLR via a data connection". A value representative of the TRN is 
contained in the TRN data field and is used by the MSC to associate the 
correct MS with the data connection (Le., HT? 38, VLR 14, and MSC 10), see 

20 steps S15 and S17 of FIG. 4B. 

The MSC 10 responds to the HLR's 38 request by issuing a 
OTAServiceProgramming RETURN RESULT message, otaserprog 
(Temporary MSID, ESN, MSID presently stored in die mobile station), see 
step S19 of FIG. 4B. The otaserprog message effectively reports the mobile 

25 station Tb identification to the HLR 38 in the form of an ESN and the MSID 
presentiy stored m the mobile station and also sends the temporary MSID to 
the HLR. 

At step 900, the VLR 14 relays die temporary MSID, the MSID 
presentiy stored in the mobile station and ESN to die HLR 38, where it is 

30 received by die HLR 38. We are assuming the temporary MSID, the MSID 
presently stored fci die MS and the ESN were not communicated to the CSC 
during the voice call set up and hence need to be retrieved from the MSC. 
Having die temporary MSID and die mobile station's ESN, die HLR 38 is 
then free to keep a record of the mobile station Ts programming data and 

35 can send relevant portions of die programming data to die mobile station 2 
via an OTA Data message sent encapsulated to the MSC in an 
OTASERPROG message, which is shown as step 904 (step S25 in FIG. 4B). As 
discussed above, once die programming dat« has been downloaded to die 
mobile station 2, the mobile station 2 is instructed by the HLR to store the 
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programming data, in nonvolatile memory. The voice call with the 
redirected CSC 44 gets terminated. As a result, over»the*air service 
provisioning of the mobile station is accomplished. The information 
programmed in the MS is also stored in non-volatile memory in the HLR 
5 and/or AC. 

« 

An alternative call flow is to have me CSC 44 assign a temporary 
MSID at step 500, in which case the HLR 38 would include the TRN and 
temporary MSID in the OT/ASERPROG message sent to the MSG 10. In 
response, the MSC 10 would send back an ESN and the MSID presently 
10 stored in the MS at steps 800 and 900- 

Returning to the "other functions" discussed earlier with respect to 
step S23 of FIG. 4B, HG. 4D is a flowchart of the process steps for handling 
"other functions ~. The relationship between FIGS. 4B and 4D is that if in 
step $23 of FIG. 4B, it is determined that "other functions* 1 are to be 
15 performed before the over-the-air service provisioning process proceeds 
further, the process flows from step S23 to step S39 in FIG. 4D. If no "other 
functions" axe to be implemented, the process proceeds to step S25 as shown 
in FIG. 4B. "Other Functions" as implemented in the present Invention are 
explained with reference to FIG. 4D and FIGS* 6, 7 and & 
20 HG. 4D is a flowchart of a process that is a continuation of the process 

shown in FIG. 4B. In step S39 CSC 26 (or HLR 18) determines whether an A~ 
Key download procedure (to be described with reference to FIG* 6) is to be 
performed, and performs the A-key download procedure in step S40, and 
than proceeds to step S41. If it is determined in step S39 that no A-key 
25 download procedure is to be performed, tne process flows to step S41, which 
inquires whether an SSD update procedure (to be described with reference to 
FIG. 7) is to be performed- If so, the process proceeds to step S42 where the 
SSD update procedure is per for med, and the process proceeds to step $43. If 
it is determined in step S41 than no SSD update procedure is to be 
30 performed, the process proceeds to step $43, where an inquiry is tt>^- 
regarding whether a reauthentication procedure (to be described with a . 
to FIG. 8) is to be performed. If so, the process proceeds to step S44, where 
the reauthentication procedure is performed. Otherwise, the process returns 
to step $25 in FIG. 4B. If A-Key download is performed/ and if voice privacy 
35 and/or message encryption is desired, SSD update necessarily precedes the 
reauthentication procedure. Each of the A-key download procedure, SSD 
update procedure, and Reauthentication procedure are described in more 
detail below. 
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Since the AC and the HLR can be separate from each other, the 
following discussion with respect to AC procedures presumes an AC that is 
separate horn the HLR. 

There are four operations that involve the AC: 
5 1) Generating the A-key and transferring it to the mobile station (in 

what follows we implement the Rivest-Shamir-Adleinan (RSA) method for 
A-Key Download, other methods for A-Key Download could be used as 
well); 

2) Updating SSD; 
10 3) Generating the VPMASK and SMEKEY; and 

4) Storing the A-key and SSD into non-volatile memory. 
There are several issues which must be addressed. 

1) Where the authentication and A-key transfer related operations are 
initiated, the approach according to the present invention is to have them 

15 done in the AC Thus, the HLR does not receive the A-key, the decryption 
exponent, or the product of the primes P and Q. 

2) Where the OTA Data Messages are generated for the A-key transfer, 
according to the present invention die message is generated in the AC, 
encapsulated, and passed either directly or through the HLR to the 

20 MSC/VLR Alternatively, the parameters are generated in the AC and 
passed to the HLR where the OTA Data Messages are formed. The former 
approach is preferable. 

3) Whether the CSC directly interfaces with the AC, or through the 
HLR* according to the present invention the HLR is in control and thus, the 

25 CSC essentially only interfaces with the HLR. 

4) The AC needs to be triggered by the HLR to generate the appropriate 
OTA Data Messages* Similarly, the AC needs to inform die HLR when the 
AC has completed its action. 

The A-Key Download procedure according to the present invention is 
30 described with reference to FIG. 6* In FIG. 6, at step 1500, the ne 

AuthenticationCenterDirective INVOKE message, ACDIR (temporary MSID, 
ESN, ACACTION) is generated by the HLR 18 or 38 and sent to the AC 22 or 
42. This INVOKE message according to the present invention contains the 
ACACTION field directing the AC 22 to perform an A-key download for the 
35 subject mobile station 2 (HG. 1). The mobile station 2 is identified by values 
included in the temporary MSID and ESN data fields of die ACDIR message. 

At step 1600, the AC 22 (or 42) transfers the temporary MSID, ESN and 
a public encryption key generated at the AC in an OTA Data Message, 
OT ASERPROG [MIN, ESN, OTA Data Message) message, to HLR 18 (or HLR 
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38) via an OTAServiceProgramming INVOKE message. The OTASERPROC 
message gets forwarded from the HLR to the MSC via the VUt At the MSC, 
the OTA Data message containing the public encryption key gets sent to the 
mobile station. Once the mobile station 2 is in possession of the public 
5 encryption key, it uses it to encode aisession mask which it transmits to the 
MSC in an OTA Data Message. 

At step 1900, MSC 10 responds via the OTAServiceProgramming 
RETURN RESULT message, otaserprog IOTA Data Message] containing the 
encoded session mask within the OTA Data Message. The otaserprog 
10 message is relayed to the AC in steps 2000 and 2100. 

The AC decodes the session mask since it has the public encryption 
key and other parameters used to compute the public encryption key. The 
AC selects an A-Key, encodes it using the session mask. At step 2200, the AC , 
22 (or 42) transfers the temporary MSJT *"T * the OTA Data Message 
15 containing the encoded A-Key in tt»e OTAServke programming INVOKE 
message, OTASERPROG (temporary iMSID, ESN, OTA Data message) to the 
HLR. Steps 2300 and 2400 relay the AC'S encoded A-Key to the mobile 
station 2. The MS is able to decode die A-Key since it has the session mask 
that was used by the AC to encode the A-Key. 
20 At step 2500, the MSC 10 transfers from the mobile station 2 an OTA 

Data Message containing a confirmation that the A-Key was successfully 
received in an OTADataMessage, * OTAServiceProgramming RETURN 
RESULT message, otaserprogJOTA data Message]. In steps 2600 and 2700 the 
mobile station 2's confirmation is relayed to the AC 
25 At step 28 00, the AC 22 or 4 2 sends an empty 

AuthenticationCenterDirective RETURN RESULT to HLR 18 or 38 as an 
acknowledgment to the HLR 18 or 38 that HUECs request to Invoke an A-key 
download in step 1500 has now beenj completed. 

The SSD-Update procedure according to the present invention is 
30 described with reference to HC. 7. (The exemplary procedure and signaling 
scheme shown in FIG- 7 corresponds to the case in which SSD is not shared. 
Since the CSC may not actually decide to commit to the parameters that, 
have been downloaded into the mobile ^---p * ?t is preferable that the SSD 
not be shared during an SSD update while OTA service programming. 
35 Nevertheless, sharing SSD couljd be used. Note that significant 
modifications to IS-41-C are not required to implement the SSD Update 
procedure according to the present! invention- The AC is triggered by the 
HLR to perform SSD-Update and the HLR is informed by the AC at the 
conclusion of the SSD Update procedure. 
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Step 2900, of the call flow diagram of FIG. 7, shows a new 15-41 
AuthenticationCenterDirective INVOKE message, ACDIRI temporary MSID, 
ESN, ACACTION, MSID presently in MS], according to the present 
invention that is transmitted from the HLR to the AC to request an SSD 
5 update procedure be performed. The) message contains an AC ACTION field 
which directs the AC 22 (or 42 if HLR 38 is selected) to perform an SSD 
update. The SSD update operation cab be commenced immediately after the 
A-key was downloaded to the mobile station. Steps 3000-5300 are similar to 
those that exist for SSD Update procedure in IS41-C. Note that the MSID 
10 frequently stored in the MS is sent; to the AC for use in computing the 
Authentication Response to a base station challenge from the MS. Base 
station challenge procedure forms part of die SSD update procedure. 

At step 5 400, HLR 18 (or 38) sends an empty 
AuthenticationCenterDirective, acdir{),measag* to AC 22 (or 42) as an 
15 acknowledgment completing the SSD Update Procedure 

Re-authentication for enabling^ Voice Privacy, Message Encryption or 
both, according to the present invention, are accomplished as follows. 

Re-Authentication according to the present invention is 

implemented through the call flow illu* L » FIG. 8. In this figure, at 

20 step 5500, the new 1&41 message AuthenticationCenterDirective, INVOKE, 
ACDIR[teinporary MSID, ESN, DGTSDIAL, ACACTION), contains the 
ACACTION field directing the AC|22 (or AC 42 if HLR 38 is selected) to 
perf or m the ^authentication procedure- Also included in the message are 
the temporary MSID, ESN and DGTSDIAL parameters (digits dialed by the 
25 mobile station). 

At step 5600, die AC 22 (or |42) transfers an OTA Data Message 
containing a Random Number (RANf>) to HLR 18 (or HLR 38 if selected) via 
the OTAServjceProgramming INVOKE message, OTASERPROG[OTA Data 
Message), which will ultimately be ijecerved by the MSC 10* Steps 5700 and 
30 5800 relay the message to the MSC 1«}- At the MSC 10, the OTA Data Message 
containing RAND is sent to the; mobile station. The mobile station 
compute an Authentication Response (AUTHR) and includes it along with 
other parameters in an OTA Data Message to the MSC 10. 

At step 5900, MSC 10 responds to die AC's message by sending the 
35 OTA Data Message containing AUTHR to VLR 14 via a 
OTAServkeProgramming RETURN RESULT message, otaserprog[OTA Data 
Message]. Steps 6000 and 6100 relay fhe MSCs message to the AC 22. 

At step 6200, the AC 22 dete*mii*_ 1~ the mobile station has been 
reauthentkated correctly and sends; the SMEKEY and VPMASK parameters 
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to the HLR 18 via a AuthenticationCenterDirective RETURN RESULT 
message, acdir{SMEK£Y, VPMASKJ- Step 6300 and 6400 relay these 
parameters to the MSC 10 in in OTAServicePrograinming INVOKE 
message. Once provided with th^ SMEKEY and VPMASK, the MSC 10 is 

5 equipped to employ voice privacy and rr* ^™ enayption. 

At step 6500, MSC 10 sends an empty OTAServiceProgramming 
RETURN RESULT message, otasebproglJ, serving as an acknowledgment 
that the VPMASK and the SMEKEhf were received at the MSC 10, which is 
relayed in step 6600 to the HLR. 

10 While the VPMASK and SMEKEY parameters may be included in the 

OTASexviceProgramming INVOKE the first time it is sent to the MSC, 
carrying the RAND parameter encapsulated in the OTA Data Message, 
preferably these parameters are sent to the MSC after the AC receives the 
MS's Re-Authentication Response. 5 This is preferred since the MSC does not 

15 have to determine whether the mobile station re-authentication process was 
successful- with this procedure, the AC knows this information and sends 
the VPMASK and die SMEKEY to the MSC only if the MS re-authenticated 
successfully. 

Modifications to IS41 network according to the present invention for 
20 implementing Re-authentication; for enabling Voice Privacy, Message 
Encryption or both are to include VPMASK and SMEKEY in the 
OTAServicePrograinming INVOKE. 

Returning to Step S3S of FK2. 4B discussed earlier Registration of the 
Mobile Station 2 after OTA service prog-* -Tuning according to the present 
25 invention is accomplished as follows. 

If the OTA service programming has been successful and the MSID 
has changed, the MSC/VLR should delete any database entry for the old 
MSID. The serving MSC/VLR should send a registration notification to the 
HLR to register the mobile station 2 and to obtain the user's profile. If the 
30 MSID has not changed, then the -HLR can update die serving MSC/VLR 
with the 1S41C operation*- QualificationDirectlve and the 
AuthenticationDixective based on the information held at die HLR. 

When the MSID has chanjged, it is desirable that the MSC/VLR 
perform normal IS-41 registration operations and obtain the user profile* 
35 However, the MSC does not know the new MSID, unless the MSC has 
parsed the OTA Data Message-which is not desirable 

In IS-6B3, the CDMA air interface standard for Over-the Air Service 
Programming, the mobile stations registration parameters are not set to 
values which cause registration When the mobile station completes OTA 
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service programming and returns to monitoring a control channel. Since 
the mobile station may have the conject system identification number (SID), 
Network Identification number (NID), and registration zones, registration 
may not occur until the mobile station originates a call, the mobile station 
moves and registration is triggered! or the mobile station station s timer 
expires and performs periodic registration. While operating in the CDMA 
mode, the mobile station can be forced to register (assuming that the 
appropriate registration methods an enabled in the IS-95 System Parameters 
Message) by sending the mobile station the IS-95 Mobile Station Registered 
Message with the parameters set to values Urnich will trigger registration. 
For example, setting the SID equal td 0 will trigger registration if parameter 
registration or zone based registration is enabled. In CDMA mode, the base 
station can obtain the MDM (IMSI) by an IS-95 Status Message. These 
methods cannot be used when performing OTA service programming in the 
analog mode. 

Alternatively, registration can be done by transferring the new MSID 
to the MSC in one of the OTAServiceProgramming messages since the MSC 
only has the temporary MSID and the MSID previously stored in the MS. 
This permits the MSC to perform the IS-41 Registration Notification 
operation. Another alternative is modify IS-683 and other air interface 
OTASP standards to have the mobile station dear its registration variables 
when performing OTA service programming. This wfll cause the mobile 
station to register when it returns to] the CDMA Paging Channel or analog 
control channel. i 

Upon receiving a successful indication of OTA service programming 
in which the MSID has changed, the serving MSC should also delete the old 
MSID from its database and perform the existing IS 41-C MSInactive 
operation with the old MSID (see Fiq5) to the old HLR. It may be desirable 
to indicate to the old HLR that dw M^ID or J* mobile station was changed. 
This could help avoid fraudulent entry into the network. 

Releasing a Call according to the present mvention is accomplished as 
follows. ) 

The call can be released by jkhe mobile station when the service 
programming session is completed. ] t should also be releasable by the CSC 
when the service programming session is completed. 

The previous description of tits preferred embodiments is provided to 
enable any person skilled in the art to make or use the present mvention. 
The various modifications to these embodiments will be readily apparent to 
those skilled in the art, and the gen sic principles defined herein may be 
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applied to other embodiments without the use of the inventive faculty. 
Thus, the present invention is not intended to be limited to the 
embodiments shown herein but is to be accorded the widest scope consistent 
with the principles and novel features disclosed herein. 
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CLAIMS 

1. A method for over-the-air service programming a mobile 
station in a communications network, comprising the steps of: 

transmitting service programming information from said 
communications network; and 

receiving at said mobile station said service programming 
information* 

2L A system for over-the-air service programming a mobile 
station in a communications network, comprising: 

means for transmitting service programming information from said 
i communications network; and 

said mobile station for receiving at said mobile station said service 
i programming information. 

3. A method for over-the-air service programming a mobile 

1 station in a communications network, comprising the steps of: 

receiving at said mobile station service programming information 
L transmitted from said communications network; and 

storing said said service programming information. 

4. A method for over-the-air service programming a mobile 

2 station in a communications network, comprising the steps of. 

generating service programming information in said 
A communications network; and 

transmitting and service programming information from said 
6 communications network. 

5. A method for communicating information from a mobile 
2 station/ comprising the steps of: 

generating said information at said jmobile station; and 
4 transmitting said information from said mobile station. 
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